Enhanced Write Filter Status Service
This service creates an icon in the System Tray that shows the status of EWF. The EWF Status icon will appear as a red “lock” when disabled, a green “lock” when enabled, and a yellow “lock” when the state is set to change on the next boot.
| Status | Description | Example | |
|
|
|
|
|
| Red | Disabled |
|
|
|
|
|
|
|
| Green | Enabled |
|
|
|
|
|
|
|
| Yellow | Commit Mode |
|
|
|
|
|
|
|
| Yellow with Red “X” | Write Filter Corrupted |
|
|
|
|
|
|
|
|
|
|
|
|
Important
In the event of a corrupted EWF state, you will need to
If you are
Important
Since EWF Manager console utility (ewfmgr.exe) and the EWF status service execute separate code, any status changes by ewfmgr.exe will not be automatically reflected by the EWF status icon.
To refresh the status icon after modifying EWF through ewfmgr.exe, you must
3